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Amendments to the Claims : 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

Listing of Claims : 

1 . (Original) In a data processing system including at least one client, a first file server 
coupled to the client for data access of the client to at least one file in the first file server, and at 
least a second file server coupled to the first file server for data access of the second file server to 
the file in the first file server, the second file server being programmed with a virus checker 
program, the virus checker program being executable by the second file server to perform an 
anti-virus scan upon file data in random access memory of the second file server, a method 
comprising: 

the first file server responding to a request from the client for access to the file in the first 
file server by determining that an anti-virus scan of the file should be performed, and initiating 
the anti-virus scan of the file by sending to the second file server a request for the anti-virus scan 
including a specification of the file, and then 

the second file server responding to the request for the anti-virus scan by invoking the 
virus checker program to perform an anti-virus scan of the specified file by obtaining file data of 
the file from the first file server and storing the file data of the file into the random access 
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memory of the second file server and performing the anti-virus scan upon the file data of the file 
in the random access memory. 

2. (Original) The method as claimed in claim 1 , wherein the first file server determines 
that the anti-virus scan of the file should be performed when the client requests the first file 
server to open the file and the first file server finds that the file has not been checked for viruses. 

3. (Original) The method as claimed in claim 1 , wherein the first file server determines 
that the anti-virus scan of the file should be performed when the client requests a file to be closed 
after the client writes to the file. 

4. (Original) The method as claimed in claim 1, wherein the first file server applies a filter 
to a file extension of the file to determine that the anti-virus scan of the file should be performed. 

5. (Original) The method as claimed in claim 1 , wherein the first file server blocks clients 
from accessing the file from the time that the first file server determines that the anti-virus scan 
of the file should be performed until the anti-virus scan is completed and fails to find a virus in 
the file. 
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6. (Original) The method as claimed in claim 1, wherein the first file server determines 
that an additional anti-virus scan of the file should not be performed in response to the access of 
the file by the virus checker program. 

7. (Original) The method as claimed in claim 1 , wherein the first file server maintains in 
nonvolatile memory an indication of files that have not been checked for viruses, an indication of 
files that are in the process of being checked, and an indication of files that have been found to 
contain viruses. 

8. (Original) The method as claimed in claim 1 , wherein the request for the anti-virus scan 
including a specification of the file is an Open Network Computing Remote Procedure Call. 

9. (Currently amended) The method as claimed in claim 1, wherein the second file server 
receives the request for the anti-virus scan and indirectly invokes the virus checker program by 
reporting a file access event to an operating system of the second file server, and the operating 
system of the second file server responds by invoking the virus checker program to perform the 
anti- virus scan of the file. 

1 0. (Original) The method as claimed in claim 1 , wherein the operating system of the 
second file server supports processes executing in a user mode and processes executing in a 
kernel mode, and a server for virus checking executing in the user mode receives the request for 
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the anti-virus scan from the first file server and forwards the request to a virus checker initiator 
driver executing in the kernel mode, and the virus checker initiator driver executing in the kernel 
mode initiates a file access event, and the virus checker program initiates the anti-virus scan of 
the file in response to the virus checker initiator driver initiating the file access event. 

1 1 . (Original) The method as claimed in claim 1 0, wherein an input/output manager in the 
operating system of the second file server receives a file access call from the virus checker 
initiator driver, and responds by directing a report of the file access event to the virus checker 
program. 

1 2. (Original) The method as claimed in claim 1 , wherein the data processing system 
includes at least a third file server coupled to the first file server for data access of the third file 
server to the file in the first file server, the third file server also being programmed with a virus 
checker program that is executable by the third file server to perform an anti-virus scan upon file 
data in random access memory of the third file server, wherein the first file server performs a 
load balancing procedure to select one of at least the second file server or the third file server to 
perform an anti-virus scan of the file when the first file server determines that an anti-virus scan 
of the file should be performed. 

13. (Original) A method of operating a network file server to initiate a virus scan upon a file 
stored in the network file server, the network file server being coupled to at least one client for 
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access of the client to at least one file in the network file server, the network file server being 
coupled to a plurality of secondary servers for access of the secondary servers to the file stored in 
the network file server, the network file server including a cached disk array and a plurality of 
data mover computers coupled to the data network and coupled to the cached disk array for 
responding to client requests for data access to storage in the cached disk array, each secondary 
server being programmed with a virus checker program executable for performing an anti-virus 
scan upon file data in random access memory of said each secondary server, a method 
comprising: 

at least one of the data movers in the network file server responding to a request from the 
client for access to the file in the network file server by applying a filter upon a file extension of 
the file upon opening or closing of the file to determine that an anti-virus scan of the file should 
be performed, and initiating the anti-virus scan of the file by applying a load balancing procedure 
for selecting one of the secondary servers for performing the anti-virus scan of the file, and 
sending to the selected secondary server a request for the anti-virus scan including a specification 
of the file, and then 

the selected secondary server responding to the request for the anti-virus scan by 
invoking the virus checker program in the selected secondary server to perform an anti-virus 
scan of the specified file by obtaining file data of the file from the network file server and storing 
the file data of the file into the random access memory of the selected secondary server and 
performing the anti-virus scan upon the file data of the file in the random access memory of the 
selected secondary server. 
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14. (Original) The method as claimed in claim 13, wherein the file is an executable file, and 
the network file server determines that the anti-virus scan of the file should be performed when 
the client requests the network file server to open the file and the network file server finds that 
the file has not been checked for viruses, and the network file server also determines that the 
anti-virus scan of the file should be performed when the client requests the file to be closed after 
the client writes to the file. 

15. (Original) The method as claimed in claim 13, wherein the selected secondary server 
receives the request for the anti-virus scan and indirectly invokes the virus checker program by 
causing an operating system of the selected secondary server to invoke the virus checker 
program in the selected secondary server to perform the anti -virus scan of the file. 

1 6. (Original) In a data network including a first server and a second server, the second 
server being coupled by a data network to the first server for access of the second server to at 
least one file stored in the first server, wherein the second server is programmed with an 
operating system supporting processes executing in a user mode and processes executing in a 
kernel mode, the operating system of the second server including an input/output manager 
executing in the kernel mode, a method of operating the second server to perform an anti-virus 
scan upon the file in the first server, said method comprising: 
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a server for virus checking executing in the second server in the user mode receives from 
the network a request for the anti-virus scan upon the file, and then 

the server for virus checking forwards the request to a virus checker initiator driver 
executing in the second server in the kernel mode, and the virus checker initiator driver responds 
to receipt of the request by sending a file access call to the input/output manager, and then 

the input/output manager responds to the file access call by directing a report of a file 
access event to a virus checker program executing in the second server in the user mode, and the 
virus checker program responds by obtaining file data from the file in the first server and storing 
the file data in random access memory in the second server, and performing an anti-virus scan 
upon the file data in the random access memory in the second server. 

17. (Original) In a data processing system including at least one client, at least one network 
file server coupled to the client by a data network for access of the client to at least one file in the 
network file server, and a plurality of NT file servers coupled to the network file server by the 
data network for data access of the NT file servers to the file in the network file server, the 
network file server including a cached disk array and a plurality of data mover computers 
coupled to the data network and coupled to the cached disk array for responding to client 
requests for data access to storage in the cached disk array, each of the NT file servers being 
programmed with a virus checker program, the virus checker program in each NT file server 
being executable by said each NT file server to perform an anti-virus scan upon file data in 
random access memory of said each NT file server, a method comprising: 
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a data mover in the network file server responding to a request from the client for access 
to the file in the network file server by applying a filter upon a file extension of the file upon 
opening or closing of the file to determine that an anti-virus scan of the file should be performed, 
and initiating the anti-virus scan of the file by selecting a next one of the NT file servers in 
round-robin fashion and sending to the selected NT file server a request for the anti-virus scan 
including a specification of the file, and then 

the selected NT file server responding to the request for the anti-virus scan by invoking 
the virus checker program in the selected NT file server to perform an anti-virus scan of the 
specified file by obtaining file data of the file from the network file server and storing the file 
data of the file in the random access memory of the selected NT file server and performing the 
anti-virus scan upon the file data of the file in the random access memory of the selected NT file 
server. 

1 8. (Original) The method as claimed in claim 1 7, wherein the file is an executable file and 
the network file server determines that the anti-virus scan of the file should be performed when 
the client requests the network file server to open the file and the network file server finds that 
the file has not been checked for viruses, and the network file server also determines that the 
anti-virus scan of the file should be performed when the client requests the file to be closed after 
the client writes to the file. 
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1 9. (Original) The method as claimed in claim 1 7, wherein the operating system of the 
selected NT file server supports processes executing in a user mode and processes executing in a 
kernel mode, a server for virus checking executing in the user mode receives the request for the 
anti-virus scan from the network file server and forwards the request to a virus checker initiator 
driver executing in the kernel mode, the virus checker initiator driver executing in the kernel 
mode sends a file access call to an input/output manager in the operating system of the selected 
NT file server, the input/output manager responds to the file access call by directing a report of a 
file access event to the virus checker program in the selected NT file server, and the virus 
checker program in the selected NT file server initiates the anti-virus scan of the file in response 
to receiving the report of the file access event from the input/output manager. 

20. (Original) A data processing system comprising: 
at least one client; 

a first file server coupled to the client for access of the client to at least one file in the first 
file server; and 

at least a second file server coupled to the first file server for data access of the second 
file server to the file in the first file server, the second file server being programmed with a virus 
checker program, the virus checker program being executable by the second file server to 
perform an anti-virus scan upon file data in random access memory of the second file server; 

wherein the first file server is programmed to respond to a request from the client for 
access to the file in the first file server by determining that an anti-virus scan of the file should be 
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performed, and initiating the anti-virus scan of the file by sending to the second file server a 
request for the anti-virus scan including a specification of the file; and 

the second file server is programmed to respond to the request for the anti-virus scan by 
invoking the virus checker program to perform an anti-virus scan of the specified file by 
obtaining file data of the file from the first file server and storing the file data of the file in the 
random access memory of the second file server and performing the anti-virus scan upon the file 
data in the random access memory. 

21 . (Original) The data processing system as claimed in claim 20, wherein the first file 
server is programmed to determine that the anti-virus scan of the file should be performed when 
the client requests the first file server to open the file and the first file server finds that the file 
has not been checked for viruses. 

22. (Original) The data processing system as claimed in claim 20, wherein the first file 
server is programmed to determine that the anti-virus scan of the file should be performed when 
the client requests a file to be closed after the client writes to the file. 

23. (Original) The data processing system as claimed in claim 20, wherein the first file 
server is programmed to apply a filter to a file extension of the file to determine that the anti- 
virus scan of the file should be performed. 
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24. (Original) The data processing system as claimed in claim 20, wherein the first file 
server is programmed to block clients from accessing the file from the time that the first file 
server determines that the anti-virus scan of the file should be performed until the anti-virus scan 
is completed and fails to find a virus in the file. 

25. (Original) The data processing system as claimed in claim 20, wherein the first file 
server is programmed to determine that an additional anti-virus scan of the file should not be 
performed in response to the access of the file by the virus checker program. 

26. (Original) The data processing system as claimed in claim 20, wherein the first file 
server is programmed to maintain in nonvolatile memory an indication of files that have not been 
checked for viruses, an indication of files that are in the process of being checked, and an 
indication of files that have been found to contain viruses. 

27. (Original) The data processing system as claimed in claim 20, wherein the request for 
the anti-virus scan including a specification of the file is an Open Network Computing Remote 
Procedure Call. 

28. (Currently amended) The data processing system as claimed in claim 20, wherein the 
second file server is programmed to receive the request for the anti-virus scan and indirectly 
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invoke the virus checker program by causing an operating system of the second file server to 
invoke the virus checker program to perform the anti-virus scan of the file. 

29. (Original) The data processing system as claimed in claim 20, wherein the operating 
system of the second file server supports processes executing in a user mode and processes 
executing in a kernel mode, and the second file server includes a server for virus checking that is 
executable in the user mode and a virus checker initiator driver that is executable in the kernel 
mode, the server for virus checking being executable for receiving the request for the anti- virus 
scan from the first file server and forwarding the request to the virus checker initiator driver, and 
the virus checker initiator driver is executable for causing the operating system reporting a file 
access event to the virus checker program, and the virus checker program is executable for 
initiating the anti-virus scan of the file in response to the report of the file access event. 

30. (Original) The data processing system as claimed in claim 29, wherein the operating 
system of the second file server includes an input/output manager that is executable in the kernel 
mode for receiving a file access call from the virus checker initiator driver, and responding to the 
file access call by directing the report of the file access event to the virus checker program. 

3 1 . (Original) The data processing system as claimed in claim 20, which further includes at 
least a third file server coupled to the first file server for data access of the third file server to the 
file in the first file server, the third file server also being programmed with a virus checker 
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program that is executable by the third file server to perform an anti-virus scan upon file data in 
random access memory of the third file server, and wherein the first file server is programmed 
for performing a load balancing procedure to select one of at least the second file server or the 
third file server to perform an anti-virus scan of the file when the first file server determines that 
an anti-virus scan of the file should be performed. 

32. (Original) A network file server adapted for coupling to at least one client for access of 
the client to at least one file in the network file server, the network file server also being adapted 
for coupling to a plurality of secondary servers for access of the secondary servers to the file 
stored in the network file server, each secondary server being programmed with a virus checker 
program executable for transferring file data from the file in the network file server to random 
access memory in said each secondary server, and performing an anti-virus scan upon the file 
data in the random access memory of said each secondary server, the network file server 
comprising: 

a cached disk array; and 

a plurality of data mover computers coupled to the data network and coupled to the 
cached disk array for responding to client requests for data access to storage in the cached disk 
array, wherein at least one of the data movers is programmed to respond to a request from the 
client for access to the file in the network file server by applying a filter upon a file extension of 
the file upon opening or closing of the file to determine that an anti-virus scan of the file should 
be performed, and initiating the anti-virus scan of the file by applying a load balancing procedure 
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for selecting one of the secondary servers for performing the anti-virus scan of the file, and 
sending to the selected secondary server a request for the anti-virus scan including a specification 
of the file. 

33. (Original) The data processing system as claimed in claim 32, wherein the file is 
executable and the network file server is programmed to determine that an anti-virus scan of the 
file should be performed when the client requests the network file server to open the file and the 
network file server finds that the file has not been checked for viruses, and the network file 
server is also programmed to determine that the anti-virus scan of the file should be performed 
when the client requests the file to be closed after the client writes to the file. 

34. (Original) A secondary server adapted for coupling to a primary server in a data network 
for access to data in files in the primary server, wherein the secondary server is programmed 
with an operating system supporting processes executing in a user mode and processes executing 
in a kernel mode, the operating system including an input/output manager executable in the 
kernel mode, wherein the secondary server is further programmed with: 

a server for virus checking executable in the user mode; 
a virus checking driver executable in the kernel mode; and 
a virus checker program executable in the user mode; 
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wherein the server for virus checking is executable for receiving from the network a 
request for an anti-virus scan upon a specified file in the primary server, and for forwarding the 
request to the virus checker initiator driver; 

wherein the virus checker initiator driver is executable for responding to receipt of the 
request from the server for virus checking by sending a file access call upon the specified file to 
the input/output manager; 

wherein the input/output manager is executable for responding to the file access call by 
directing a report of a file access event upon the specified file to the virus checker program; and 

wherein the virus checker program is executable for responding to the report of the file 
access event by transferring file data from the specified file in the primary server to random 
access memory in the secondary server, and performing an anti-virus scan upon the file data in 
the random access memory in the secondary server. 

35. (Original) A data processing system comprising: 
at least one client; 

at least one network file server coupled to the client by a data network for access of the 
client to at least one file in the network file server; and 

a plurality of NT file servers coupled to the network file server by the data network for 
data access of the NT file servers to the file in the network file server; 
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wherein the network file server includes a cached disk array and a plurality of data mover 
computers coupled to the data network and coupled to the cached disk array for responding to 
client requests for data access to storage in the cached disk array; 

wherein each of the NT file servers is programmed with a virus checker program, the 
virus checker program being executable by said each NT file server to perform an anti-virus scan 
upon file data in random access memory of said each NT file server; 

wherein at least one data mover in the network file server is programmed for responding 
to a request from the client for access to the file in the network file server by applying a filter 
upon a file extension of the file upon opening or closing of the file to determine that an anti-virus 
scan of the file should be performed, and initiating the anti-virus scan of the file by selecting a 
next one of the NT file servers in round-robin fashion and sending to the selected NT file server 
a request for the anti- virus scan including a specification of the file, and 

wherein each NT file server is programmed to respond to the request for the anti-virus 
scan by invoking the virus checker program in said each NT file server to perform an anti-virus 
scan of the specified file by obtaining file data of the specified file from the network file server 
and storing the file data of the specified file in the random access memory of said each NT file 
server and performing the anti-virus scan upon the file data of the specified file in the random 
access memory of said each NT file server. 

36. (Original) The data processing system as claimed in claim 35, wherein the file is an 
executable file, and the network file server is programmed for determining that the anti-virus 
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scan of the file should be performed when the client requests the network file server to open the 
file and the network file server finds that the file has not been checked for viruses, and the 
network file server also determines that the anti-virus scan of the file should be performed when 
the client requests the file to be closed after the client writes to the file. 

37. (Original) The data processing system as claimed in claim 35, wherein the selected NT 
file server is programmed with: 

an operating system supporting processes executing in a user mode and processes 
executing in a kernel mode, the operating system including an input/output manager executable 
in the kernel mode; 

a server for virus checking executable in the user mode; and 

a virus checker initiator driver executable in the kernel mode; 

wherein the server for virus checking is executable for receiving the request for the anti- 
virus scan from the network file server and forwarding the request to the virus checker initiator 
driver; 

wherein the virus checker initiator driver is executable for responding to the request from 
the server for virus checking by sending a file access call to the input/output manager; 

wherein the input/output manager is executable for responding to the file access call by 
directing a report of a file access event to the virus checker program in the selected NT file 
server; and 
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wherein the virus checker program in the selected NT file server is executable for 
performing the anti-virus scan of the file in response to receiving the report of the file access 
event from the input/output manager. 

38. (Original) A program storage device containing a program executable by a network file 
server, the network file server being adapted for coupling to at least one client for access of the 
client to at least one file in the network file server, the network file server also being adapted for 
coupling to a plurality of secondary servers for access of the secondary servers to the file stored 
in the network file server, each secondary server being programmed with a virus checker 
program executable for transferring file data from the file in the network file server to random 
access memory in said each secondary server, and performing an anti-virus scan upon the file 
data in the random access memory of said each secondary server, the program contained in the 
program storage device being executable by the network file server for responding to a request 
from the client for access to the file in the network file server by applying a filter upon a file 
extension of the file upon opening or closing of the file to determine that an anti-virus scan of the 
file should be performed, and initiating the anti-virus scan of the file by applying a load 
balancing procedure for selecting one of the secondary servers for performing the anti-virus scan 
of the file, and sending to the selected secondary server a request for the anti-virus scan 
including a specification of the file. 
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39. (Original) The program storage device as claimed in claim 38, wherein the file is an 
executable file, and the program contained in the program storage device is also executable by 
the network file server for determining that an anti-virus scan of the file should be performed 
when the client requests the network file server to open the file and the network file server finds 
that the file has not been checked for viruses, and the program contained in the program storage 
device is also executable by the network file server for determining that the anti-virus scan of the 
file should be performed when the client requests the file to be closed after the client writes to 
the file. 

40. (Original) A program storage device containing a program executable by a secondary 
server, the secondary server being adapted for coupling to a primary server in a data network for 
access to data in files in the primary server, wherein the secondary server is programmable with 
an operating system supporting processes executing in a user mode and processes executing in a 
kernel mode, the operating system including an input/output manager executable in the kernel 
mode, and the secondary server is also programmable with a virus checker program for 
performing an anti-virus scan upon file data in response to a file opening event being reported to 
the input/output manager, wherein the program contained in the program storage device 
includes: 

a server for virus checking executable in the user mode; and 
a virus checking driver executable in the kernel mode; 
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wherein the server for virus checking is executable for receiving from the network a 
request for the anti- virus scan upon a specified file in the primary server, and for forwarding the 
request to the virus checker initiator driver; and 

wherein the virus checker initiator driver is executable for responding to receipt of the 
request from the server for virus checking by sending a file access call upon the specified file to 
the input/output manager, whereby the input/output manager directs a report of a file access 
event upon the specified file to the virus checker program to initiate an anti-virus scan upon file 
data of the specified file. 
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